EP1491996B1 - Verteilungsverfahren, Verteilungssystem und Endgeräteeinrichtung - Google Patents

Verteilungsverfahren, Verteilungssystem und Endgeräteeinrichtung Download PDF

Info

Publication number
EP1491996B1
EP1491996B1 EP03715596.7A EP03715596A EP1491996B1 EP 1491996 B1 EP1491996 B1 EP 1491996B1 EP 03715596 A EP03715596 A EP 03715596A EP 1491996 B1 EP1491996 B1 EP 1491996B1
Authority
EP
European Patent Office
Prior art keywords
file
unit
software
descriptive file
security
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Lifetime
Application number
EP03715596.7A
Other languages
English (en)
French (fr)
Other versions
EP1491996A4 (de
EP1491996A1 (de
Inventor
Nobuyuki I.P.DepT.NTT DOCOMO INC. WATANABE
Hisanori Intellectual Property Dept. NTT SAWADA
Hideaki Intellectual Property Dept. NTT NISHIO
Tomonori Intellectual Property Dept. NTT NAKAMURA
Fumiaki Intellectual Property Dept. NTT MIURA
Atsuki Intellectual Property Dept. NTT TOMIOKA
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
NTT Docomo Inc
Original Assignee
NTT Docomo Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by NTT Docomo Inc filed Critical NTT Docomo Inc
Publication of EP1491996A1 publication Critical patent/EP1491996A1/de
Publication of EP1491996A4 publication Critical patent/EP1491996A4/de
Application granted granted Critical
Publication of EP1491996B1 publication Critical patent/EP1491996B1/de
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/34—Network arrangements or protocols for supporting network services or applications involving the movement of software or configuration parameters 
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/35—Protecting application or service provisioning, e.g. securing SIM application provisioning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2115—Third party
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2135—Metering
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2137—Time limited access, e.g. to a computer or data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/329—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the application layer [OSI layer 7]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H04W8/24—Transfer of terminal data
    • H04W8/245—Transfer of terminal data from a network towards a terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/04—Network layer protocols, e.g. mobile IP [Internet Protocol]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/14—Backbone network devices

Definitions

  • the present invention relates to transmitting application software to terminal units.
  • Java-AP software includes a Jar (Java Archive) file and an ADF (Application Descriptor File).
  • the Jar file contains a program, which provides a user with certain Java-AP.
  • the ADF is dependent upon the Jar file, and contains, for example, URL showing where a Jar file is stored (hereinafter, referred to as package URL), the size of a Jar file, the most recent date when a Jar file is changed and other necessary information.
  • a mobile unit downloads the relevant software to the desired Java-AP by following the process described below.
  • the mobile unit obtains an ADF pertaining to the desired Java-AP from a server unit, which constitutes WWW (World Wide Web).
  • the mobile unit which obtains an ADF checks the content of the ADF and the available volume of the memory installed in the mobile unit to determine whether the Jar file pertaining to the desired Java-AP can be installed in the mobile unit.
  • the mobile unit determines that Java-AP software can be installed, the mobile unit obtains from a server unit constituting WWW a Jar file, which contains the Java-AP software, by using package URL contained in the ADF.
  • the process of downloading Java-AP software is complete when the Jar file is obtained.
  • installation of the downloaded Java-AP software is carried out, and the Java-AP software can be activated when required.
  • the activation of Java-AP is subject to greater restriction than the activation of functions that are native to the mobile unit, such as a communication application function.
  • the activation of Java-AP is restricted in that it is unable to access confidential data contained in a mobile unit, such as telephone numbers for example.
  • Java-AP uniformly does not adequately meet the needs of a user of a mobile unit or an IP (information provider).
  • IP information provider
  • some users seem to feel that Java-AP could be allowed to refer to some of the private information stored in a mobile unit as long as security is guaranteed.
  • some IPs wish to provide more useful Java-AP, which uses some of the private information stored in a mobile unit, or some of the functions a mobile unit is equipped with.
  • a system in which a trustworthy organization such as a communication provider providing a communication service to users of mobile units, is entrusted with the responsibility of authorizing Java-AP to operate with greater flexibility.
  • the trustworthy organization notifies the operational rules to mobile units using Java-AP, and the mobile units can restrict the operation of Java-AP on the basis of the prescribed rules.
  • only a trustworthy organization should be entrusted to administer the authorization of a more flexible operation of Java-AP.
  • an ADF owned by a trustworthy organization needs to be updated oncean IP updates a Jar file.
  • the ADF is updated by cooperation between the trustworthy organization and an IP since the trustworthy organization needs to administer the ADF so as to exclude the involvement of other companies.
  • the drawback in this procedure is that the operation becomes busy.
  • updating an ADF becomes necessary at times even without the updating of a Jar file when, for example, access to a certain Jar file gets flooded, and the Jar file is moved to another server unit in the IP. In this instance, since the location where the Jar file is stored is changed, a package URL contained in the ADF needs to be changed.
  • the ADF is administered by the trustworthy organization and excludes the involvement of other agents, the updating operation of an ADF could become a very busy one.
  • XP 002329582 by Veronika Megler is entitled "i-mode-From bandwidth problem into Internet phenomenon”.
  • This paper gives a general overview of the technology of i-mode describing its success in Japan and evaluating the application of the technology to the US market.
  • the i-mode server communicates with content providers and mobile phone users. Further, the underlying technology used for providing web-based content to i-mode users is described.
  • XP 002329583 by Sun Microsystems, Inc. is entitled "Default Policy Implementation and Policy File Syntax".
  • the policy for a Java application environment, which is represented by a policy object, is described, wherein it is specified, which permissions are available for a code from various sources.
  • US 6 345 288 B1 relates to a computer based communication system and method using meta data defining a control-structure.
  • an automatic communication system operates to transfer data, meta data and methods from a provider computer to a consumer computer through a communications network. Information which changes in the provider computer is automatically updated in the consumer computer.
  • XP-002970205 describes a policy file but not how a policy file should be implemented to be used for securing the confidentiality of data on a terminal unit.
  • the present invention was developed to overcome the stated problems of the conventional art, and its object is to provide to a terminal unit, which permits operation in accordance with authorization;a system to enable transmission of software for achieving the application by transmitting a plurality of files dependent upon each other.
  • the transmission system assures security by transmitting to the terminal unit the security descriptive file after encrypting
  • the controller of the terminal unit may comprise a means for decrypting an encrypted security descriptive file transmitted by the transmission system.
  • the controller of the terminal unit may receive the security descriptive file by the communication unit via a communication path whose security is assured.
  • controller of the terminal unit may receive the security descriptive file by encrypted communication.
  • the controller of the terminal unit may receive the security descriptive file by the communication unit via a mobile communication network and an exclusive line.
  • the controller of the terminal unit may receive the security descriptive file by encrypted communication via a mobile communication network.
  • a means for restricting operation of an application in the controller of the terminal unit may restrict use of a resource on the basis of authorization information contained in the security descriptive file.
  • the resource may be a hardware resource inside the terminal unit; a hardware resource outside the terminal unit which the terminal unit can use; a software resource inside the terminal unit; a software resource outside the terminal unit which the terminal unit can use; or a network resource which the terminal unit can use.
  • means for restricting operation of an application in the controller of the terminal unit may determine a type of a use of a resource on the basis of the authorization information.
  • a terminal unit wherein the application descriptive file contains a public key of a communication provider which provides communication service to the terminal unit, wherein the security descriptive file is signed by a secret key of the communication provider, and wherein the controller inspects authenticity of a security descriptive file transmitted by the transmission system using a public key contained in the application descriptive file and notifies a storage location of the entity file to the transmission system only when the authenticity is proved, is provided.
  • a terminal unit wherein the application descriptive file and the security descriptive file contain an application identifier assigned to a corresponding application, and wherein the controller compares an application identifier contained in an application descriptive file transmitted by the transmission system to an application identifier contained in a security descriptive file transmitted by the transmission system, and notifies a storage location of the entity file to the transmission system only when both identifiers match, is provided.
  • the controller of the terminal unit may notify a storage location of the security descriptive file to the transmission system only when a storage location of the security descriptive file written in the application descriptive file is inside the administering server unit.
  • the security descriptive file contains time limit information showing an expiration date of a corresponding application
  • the controller of the terminal unit may comprise a means for repeatedly receiving the security descriptive file in a chronological order from the transmission system by repeatedly notifying a storage location of the security descriptive file to the transmission system in a chronological order; and renewing an expiration date of the application on the basis of the time limit information contained in the security descriptive file repeatedly received.
  • the terminal unit may renew an expiration date of the application only when the security descriptive file is properly transmitted from the transmission system.
  • the terminal unit may be a mobile unit.
  • IP server units 12 to 14 are connected to Internet 11.
  • IP server unit 12 is administered by the first IP (Internet Provider), and IP server units 13 and 14 are administered by the second IP, which differs from the first IP.
  • IP server units 12 to 14 constitute WWW, and each is equipped with similar hardware and functions to those of a general WWW server unit.
  • Mobile packet communication network 15 is a network a communication provider uses to provide a mobile packet communication service.
  • Mobile unit 16 can perform radio packet communication with mobile packet communication network 15.
  • Gateway server unit 17 is administered by the same communication provider as that of mobile packet communication network 15.
  • Gateway server unit 17 is a unit for connecting mobile packet communication network 15 and Internet 11, and has similar configuration to that of a general gateway server unit.
  • Administering server unit 18 is connected to gateway server unit 17 by an exclusive line.
  • Administering server unit 18 also constitutes WWW, and has similar hardware and a function to those of a general WWW unit.
  • Gateway server unit 17 performs packet communication between mobile packet communication network 15 and Internet 11, packet communication between administering server unit 18 and mobile packet communication network 15, and packet communication between administering server unit 18 and Internet 11.
  • Mobile unit 16 by using the relaying function, is able to perform packet communication with IP server units 12 to 14 via mobile packet communication network 15 and Internet 11.
  • IP server units 12 to 14 are shown.
  • mobile unit 16 is capable of receiving Java-AP software from the desired site on Internet 11.
  • Software which mobile unit 16 is capable of receiving is distinguished between the one pertaining to a trusted Java-AP and the one pertaining to a non-trusted Java-AP.
  • a trusted Java-AP software is one, which the communication provider administering mobile packet communication network 15 guarantees authenticity of on the basis of the contract with IP-administering IP server units 12 to 14.
  • a non-trusted Java-AP software is any Java-AP software other than a trusted Java-AP software.
  • Administering server unit 18 stores each SDF (Security Descriptive File) pertaining to each trusted Java-AP software, which is transmitted in the transmission system.
  • SDF is a file, which is produced by the communication provider administering mobile packet communication network 15, and is the file necessary for downloading into a mobile unit the Java-AP software, which uses trusted API (APplication Interface) of the mobile unit.
  • trusted API Application Interface
  • SDF contains APID for detecting trusted Java-AP software, policy information, and the expiration date.
  • the information is encrypted by a secret key of a communication provider.
  • Policy information is the information showing restriction on the operation of trusted Java-AP in mobile unit 16. Policy information and the restriction on Java-AP's operation carried out on the basis of the policy information will be explained in detail afterwards.
  • ADF corresponding to the trusted Java-AP software is transmitted to mobile unit 16 from one of IP server units 12-14.
  • ADF of trusted Java-AP software are contained URL showing the location of the Jar file, URL showing the location of SDF corresponding to trusted Java-AP software, and the public key paired with the secret key which is used to encrypt SDF.
  • Mobile unit 16 obtains SDF by using URL in ADF after receiving ADF, and decrypts SDF by using the public key in ADF. Then, mobile unit 16 finally obtains the Jar file by using URL of the Jar file contained in ADF.
  • trusted Java-AP software when executed in mobile unit 16, the operation of trustedJava-AP is restricted on the basis of SDF.
  • SDF This is one characteristic of the present embodiment.
  • transmission of SDF is carried out via mobile packet communication network 15, and administering server unit 18 and gateway server unit 17, which are connected by an exclusive line.
  • IP server units 12, 13 and 14 are equipped with fixed memory 12A, 13A and 14A respectively.
  • Fixed memory 12A, 13A and 14A are fixed memories such as a hard disc, and store Java-AP software constituting Jar files and ADF, and explanatory files on the content of Java-AP software for users of mobile units.
  • Each Java-AP software stored in fixed memory 12A, 13A and 14A might be either trusted Java-AP software or non-trusted Java AP software.
  • Java-AP is trusted Java-AP or non-trusted Java-AP
  • information such as a package URL showing the location where a Jar file in WWW is stored, information showing the size of the Jar file, and information showing the date of the most recent update are written.
  • Such information is generally known as items to be written in ADF of a Java-AP software.
  • ADF of trusted Java-AP software contains APID of trusted Java-AP, the hash value of the Jar file, URL showing the location where SDF is stored in WWW (hereinafter, referred to as SDF-URL), and the public key paired with the secret key used for encrypting SDF.
  • SDF-URL the public key paired with the secret key used for encrypting SDF.
  • the public key is issued to a communication provider whose authenticity is certified by CA (Certifying Agent) as a certificate.
  • the explanatory file is a text file written in accordance with HTML.
  • a mobile unit when a certain Java-AP software is downloaded, needs to download beforehand, the explanatory file corresponding to the Java-AP software.
  • the explanatory file contains information for forming UI (User Interface) for receiving from the user the command for downloading Java-AP software.
  • Mobile unit 16 displays the UI screen in accordance with the information. The user can carry out the operationon mobile unit 16 for specifying the object showing the desired Java-APon the UI screen.
  • the explanatory file is written for the object specified by the user in this manner so as to correspond to the URL showing where in WWW, ADF corresponding to Java-AP software, which is the object for downloading, is located.
  • Each of IP server units 12 to 14 is equipped with the function of producing and updating each of the above-mentioned files in accordance with the command of an IP.
  • Administering server unit 18 is equipped with fixed memory 18A such as a hard disc. Administering server unit 18 establishes a TCP connection with the party. When administering server unit 18 receives a request message which uses the GET method of HTTP from the party vial TCP connection, administering server unit 18 reads out the file identified by URL specified by GET method from fixed memory 18A, and returns a response message of HTTP containing the file, and severs the connection.
  • list file 200 for introducing to the user of mobile unit 16 downloadable Java-AP software, and respective SDF corresponding to each Java-AP software which is listed in list file 200.
  • List file 200 is a text file written in accordance with HTML.
  • the mobile unit when it needs to download certain Java-AP software, needs to obtain the explanatory file relating to the Java-AP software.
  • mobile unit 16 can obtain the explanatory file directly by accessing the IP server unit in which the explanatory file is stored.
  • mobile unit 16 can obtain the explanatory file of the desired Java-AP softwarealso by the following process as opposed to the above-mentioned direct method.
  • mobile unit 16 by accessing administering server unit 18, obtains list file 200, and displays UI screen accordingly. The user can carry out the operation on mobile unit 16 to specify the object showing the desired Java-AP on UI screen.
  • List file 200 matches the object specified by the user to URL showing the location of the explanatory file of Java-AP software in WWW, which is the object of downloading.
  • Mobile unit 16 by using URL obtained via list file 200, obtains the explanatory file from the IP server unit.
  • Mobile unit 16 consists of, as shown in Fig.5 , OS (Operating System) software; ROM 16A in which Java-AP environment software for establishing the environment for executing Java-AP, and several types of native AP software are stored; CPU 16B which is connected to ROM 16A for reading out a program from ROM 16A and executing the program; displaying unit 16C which is connected to CPU 16B; fixed memory 16D; RAM 16E; communication unit 16F; and operation unit 16G.
  • OS Operating System
  • Displaying unit 16C has, for example, a liquid crystal displaying panel, and displays data provided by CPU 16B as an image.
  • Fixed memory 16D is, for example, SRAM or EEPROM, and data is read and written by CPU 16B.
  • Fixed memory 16D is used to store Java-AP software downloaded from a server unit (hereinafter, referred to as a Web server unit) constituting WWW, and SDF.
  • the expression “Java-AP software” is used to refer to both “trusted Java-AP software” and “non-trusted Java-AP software.”
  • the expression “Java-AP software” may refer to “trusted Java-AP software.”
  • the expression "Java-AP software” should be interpreted as a concept containing ADF, SDF,and Jar.
  • the expression “Java-AP software” may refer to "non-trusted Java-AP software.”
  • the expression “Java-AP software” should be interpreted as a concept containing ADF and Jar.
  • Communication unit 16F performs radio packet communication with mobile packet communication network 15, and relays packets between CPU 16B and mobile packet communication network 15. Also, communication unit 16F is equipped with CODEC, a microphone, a speaker and so forth for communication besides an antenna or a radio transmission and reception unit. Hence, mobile unit 16, by communication unit 16F, can perform communication by circuit switching via a mobile communication network (not shown). Operation unit 16G is equipped with an operation controller, and provides CPU 16B a signal in accordance with the operation carried out by the operation controller. Timer unit 16H clocks the present date and time (hereinafter, merely referred to as the present date and hour). For timer unit 16H to clock the present date and hour more precisely, the present date and hour may be synchronized with the present date and hour notified periodically via a control channel by a base station of packet communication network 15 (not shown).
  • CPU 16B is a unit, which controls the entire mobile unit 16 in accordance with several kinds of programs stored in ROM 16A. When a switch (not shown) is turned on, CPU 16B reads out OS of Fig. 6 from ROM 16A and executes with RAM 16E as a work area.
  • CPU 16 provides a function such as UI in accordance with OS.
  • OS identifies the command of the user on the basis of the signal supplied by operation unit 16G and the status of UI, and carries out the process in accordance with the command.
  • OS activates the communication software, and executes communication AP in mobile unit 16.
  • communication AP By using communication AP, the user can communicate with the party.
  • telephone directory AP which is native AP software
  • OS activates the telephone directory software, and executes telephone directory AP in mobile unit 16.
  • telephone directory AP the user can refer to, use, and change the content of the telephone directory (hereinafter, referred to as telephone directory data) stored in fixed memory 16D.
  • Web browser software which is native AP software
  • OS activates Web browser software, and executes the Web browser in mobile unit 16.
  • the Web browser provides UI.
  • the Web browser identifies the command of the user on the basis of the status of UI and the signal provided by operation unit 16G, and executes the process in accordance with the command. For example, when the command is for obtaining the specified file from WWW, a TCP connection is established by operating communication unit 16F with the Web server unit in which the file is stored, a request message of HTTP using the GET method is transmitted by URL showing the specified location, a response message corresponding to the request message is received, and the connection is severed.
  • the Web browser interprets the file contained in the received response message in accordance with HTML, produces UI containing the Web page, and provides the user. Also, when a user sends a command for downloading Java-AP software, Web browser notifies the command to JAM (Java Application Manager). Specifically, in a Web page, either by clicking or pressing, when an anchor tag to which the object tag is specified is designated, the Web browser extracts URL which is specified as data property of the object tag, and notifies JAM that downloading of Java-AP software by URL is requested.
  • JAM Java Application Manager
  • JAM software When the command of the user requests the activation of JAM software, which is native AP software, OS activates JAM software, and executes JAM in mobile unit 16.
  • JAM shows to the user a list of Java-AP software installed in mobile unit 16, and activates the JavaAP software specified by the user.
  • Java-AP environment software is activated, and Java-AP environment is executed in mobile unit 16.
  • Java-AP environment contains KVM which is a lightweight Java Virtual Machine appropriate to a cellular terminal, and API provided for Java-AP.
  • trusted API which only Java-AP whose trustworthiness is guaranteed by the communication provider on the basis of the contract with the IP (hereinafter, referred to as trusted AP) is allowed to use
  • non-trusted API which any Java-AP is allowed to use
  • JAM when a command for requesting the downloading of Java-AP is notified by the Web browser, carries out the process for downloading and installing Java-AP software into mobile unit 16.
  • the flow of the process is shown in Fig. 7 .
  • the process of mobile unit 16 for obtaining the explanatory file is omitted. Since different modes exist for the process of obtaining the explanatory file, the process will be later explained with specific examples of the operation.
  • JAM first determines whether downloading of Java-AP software is requested (Step S11). Then, when a command for requesting downloading of Java-AP software is notified from Web browser, ADF corresponding to the Java-AP software is obtained from any one of IP server units 12-14 (Step S 12).
  • JAM establishesa TCP connection with any one of IP server units 12-14 in which ADF is stored, produces and transmits a request message requesting transmission of ADF, and severs the TCP connections after receiving a response message to the request message and obtaining ADF. Then, JAM writes ADF contained in the response message into fixed memory 16D.
  • JAM determines whether Java-AP software, which is about to be downloaded, can be installed in mobile unit 16 on the basis of the content of ADF (Step S 13). At this stage, whether installation is possible or not, may be determined on the same basis as a conventional basis such as comparison between the size of the Jar file written in ADF and the available volume in fixed memory 16D in which the Jar file can be stored.
  • JAM determines whether Java-AP software, which is about to be downloaded, is trusted Java-AP software (Step S 14). More specifically, JAM confirms whether SDF-URL is written in ADF obtained in Step S 12, and determines that SDF corresponding to the Java-AP software exists when SDF-URL is written. In other words, JAM determines that Java-AP software is trusted Java-AP software. On the other hand, JAM determines that Java-AP software is non-trusted Java-AP software when SDF-URL is not written.
  • Step S 14 when Java-AP software, which is about to be downloaded is determined to be non-trusted Java-AP (Step S 14; No), the conventional processes for downloading and installation are carried out (Step S 15).
  • JAM obtains SDF corresponding to the software from administering server unit 18 (Step S 16).
  • JAM establishes a TCP connection with administering server unit 18, produces and transmits a request message for requesting administering server unit 18 to transmit SDF stored in the location shown by SDF-URL written in ADF, and severs the above-mentioned connection after receiving a response message to the request message and obtaining SDF.
  • SDF corresponding to trusted Java-AP software contains APID, policy information, and the expiration date. SDF is further signed (encrypted) with the secret key of the communication provider. Then, JAM inspects (decrypts) the signature of SDF contained in the response message by using the public key extracted from ADF which has already been obtained, and determines the authenticity of SDF (Step S 17). When the authenticity is confirmed (Step S 17; Yes), JAM writes SDF into fixed memory 16D.
  • JAM compares APID contained in SDF with APID contained in ADF, which has already been obtained, and determines whether the APIDs match (Step S 18).
  • JAM obtains the Jar file (Step S 19). More specifically, JAM establishesa TCP connection with any one of IP servers 12-14 in which the Jar file identified by package URL contained in ADF is stored; produces and transmits a request message to request transmission of the Jar file;receives a response message to the request message; obtains the Jar file; and severs the TCP connection.
  • JAM calculates the hash value of the Jar file obtained (Step S 20).
  • any hash function can be used to calculate the hash value
  • the hash function used in mobile unit 16 and the hash function used to calculate the hash value contained in ADF must be identical.
  • IP which provides trusted Java-AP software actually calculates the hash value by the hash function used in mobile unit 16, and produces ADF.
  • Step S 21 compares the hash value calculated and the hash value extracted from ADF, and when the hash values match (Step S 21; Yes), writes the obtained Jar file into fixed memory 16D, carries out several kinds of processes relating to the installation of trusted Java-AP software (Step S 22), and notifies to the user that the installation has succeeded (Step S 23).
  • JAM monitors the operation of trusted Java-AP when trusted Java-AP software is executed, and restricts the use of trusted API.
  • the restriction is carried out in accordance with policy information in SDF stored in fixed memory 16D.
  • Step S 13; No When Java-AP software is determined to be not installable (Step S 13; No); SDF is determined to be not authentic (Step S 17; No), APID of SDF and APID of ADF do not match (Step S 18; No); or the hash value calculated and the hash value ADF has do not match (Step S 21; No), JAM notifies to the user that the installation has failed, and returns the status of mobile unit 16 to that of Step S11 or that of before Step S 11.
  • Trusted Java-AP software can be executed by mobile unit 16 until the expiration date contained in the corresponding SDF passes.
  • mobile unit 16 needs to obtain new SDF from administering server unit 18.
  • JAM JAM for renewing the expiration whenever the expiration date in SDF is reached is explained by referring to the flow chart shown in Fig. 8 .
  • JAM constantly monitors the present date and hour clocked by timer unit 16H in mobile unit 16 and a plurality of expiration dates each of which is extracted from all SDF obtained so far and stored in fixed memory 16D; and determines whether the expiration date is reached (Step S 31).
  • JAM displays a message on displaying unit 16C to ask the user whether to renew the expiration date along with the name of the Java-AP software whose expiration date is reached, and waits until the user carries out the necessary operation.
  • JAM interprets the content of the command (Step S 32; Yes), and obtains SDF corresponding to the Java-AP software whose expiration date should be renewed, from administering server unit 18 (Step S 33). More specifically, JAM refers to the memory content of fixed memory 16D; extracts SDF-URL contained in ADF which contains APID of the Java-AP software whose expiration date should be renewed; produces and transmits a request message to request administering server unit 18 the transmission of SDF stored in the location shown in SDF-URL; and severs the above-mentioned connection after receiving a response message to the request message and obtaining SDF.
  • JAM determines whether SDF is obtained by using the above-mentioned SDF-URL (Step S 34).
  • SDF cannot be obtained it is because the communication provider does not store SDF in the location shown by the above-mentioned SDF-URL in administering server 18; or because the communication provider wants to stop or discontinue the use of Java-AP software for a certain reason.
  • the reason the use of Java-AP software needs to be stopped or discontinued could be due to circumstances pertaining to IP (for example, when transmitting software a user can try only for a certain period of time), orif the contract between IP and the communication provider has expired.
  • Step S 34 When JAM succeeds in obtaining SDF (Step S 34; Yes), JAM inspects (decrypts) the signature of SDF by using the public key contained in ADF, which has already been obtained, and determines the authenticity of SDF (Step S 35).
  • Step S 35 When the authenticity is confirmed (Step S 35; Yes), JAM compares APID contained in SDF with APID contained in ADF which has already been obtained, and determines whether the APIDs match (Step S 36). When the APIDs are determined to match (Step S 36; Yes), JAM writes the obtained SDF over the previous SDF which has already been written into fixed memory 16D, and renews the expiration date in this manner.
  • Step S32 In the instances when the expiration date is determined not to be renewed by the operation of the user (Step S32; No); when SDF cannot be obtained (Step S34; No); when SDF is determined to be not authentic (Step S 35; No); or when APID of SDF and APID of ADF do not match (Step S 36; No), JAM notifies to the user that the expiration date will not be renewed, and returns the status of mobile unit 16 to that of Step S 31 or before.
  • list file 200 and SDF 204 are stored in fixed memory 18A of administering server unit 18.
  • List file 200 and SDF 204 are produced by the communication provider in accordance with the contract between IP, which administers IP server unit 13 and IP server unit 14, and the communication provider; which administers administering server unit 18.
  • list file 200 is written to provide list page 201 shown in Fig. 10 when interpreted and executed by mobile unit 16. Also, list file 200 is written, when option 201A constituting list page 201 is hit (either by being clicked or pressed), to produce a request message containing URL of explanatory file 202 (will be explained later) ("http://www.main.bbb.co.jp/ghi.html”) as a parameter of the GET method.
  • list file 200 is written, when option 201B constituting list page 201 is hit (either by being clicked or pressed), to produce a request message containing URL of explanatory file 207 (will be explained later) ("http://www.ccc.co.jp/jkl.htrnl”) as a parameter of the GET method.
  • SDF 204 contains "0001" as APID, information shown in Fig.4 as policy information, and "10:00 AM of October 1, 2002" as the expiration date which are signed by usirg the secret key of the communication provider.
  • explanatory file 211 corresponding to Java-AP software of the title "tsume-shogi" (hereinafter, referred to as the first non-trusted Java-JP software in the present embodiment), ADF 213, and Jar file 214.
  • Explanatory file 211, ADF 213, and Jar file 214 are produced by IP administering IP server unit 12. With regard to these files, the content of explanatory file 211 is shown in Fig.11 , and explanatory file 211 is written to provide explanatory page 212 shown in Fig. 12 when interpreted and executed by mobile unit 16.
  • ADF 213 contains URL of Jar file 214 ("http://www.ccc.co.jp%shogi.jar") as package URL.
  • explanatory file 207 corresponding to Java-AP software of the title "horoscope” (hereinafter, referred to as the second non-trusted Java-AP software in the present embodiment), ADF 209, and Jar file 210.
  • Explanatory file 207, ADF 209, and Jar file 210 are produced by IP administering IP server unit 12. With regard to these files, the content of explanatory file 207 is shown in Fig. 3 , and explanatory file 207 is written to provide explanatory page 208 shown in Fig. 14 when interpreted and executed by mobile unit 16.
  • ADF 209 contains URL of Jar file 210 ("http://www.ccc.co.jp/horoscope.jar") as package URL.
  • the above-mentioned first non-trusted Java-AP software and the second non-trusted Java-AP software are different in that information on the second non-trusted Java-AP software is registered with list file 200, whereas information on the first non-trusted Java-AP software is not registered.
  • explanatory file 202 corresponding to Java-AP software of the title "telephone number directory viewer" (hereinafter, referred to as trusted Java-AP software in the present embodiment), ADF 205, and Jar file 206.
  • Explanatory file 202, ADF 205, and Jar file 206 are produced by IP administering IP server unit 13 and IP server unit 14. With regard to these files, the content of explanatory file 202 is shown in Fig.15 , and explanatory file 202 is written to provide explanatory page 203 shown in Fig. 16 when interpreted and executed by mobile unit 16.
  • ADF 205 contains "0001" as APID, the hash value of Jar file 206 as a hash value, URL of Jar file 206 ("http://www.main.bbb.co.jp/viewer.jar”) as package URL, and URL of SDF 204 (http://www.aaa.co.jp/viewer.sdf”) as SDF-URL, and the public key of the communication provider. Also, mobile unit 16 is in the status in which each of the above-mentioned Java-AP software can be installed.
  • the installation operation of the first non-trusted Java-AP software begins when the user tries to obtain explanatory file 211 by operating mobile unit 16.
  • request message tm 12 containing URL of explanatory file 211 ("http://www.ccc.co.jp/mno.html") as a parameter of the GET method is produced.
  • Request message tm 12 is, as shown in Fig. 17 , transmitted by mobile unit 16, and is received by IP server unit 12.
  • response message tm 13 containing explanatory file 211 is produced in response to the content of request message tm 12.
  • Response message tm 13 is transmittedby IP server unit 12, and is received by mobile unit 16.
  • mobile unit 16 UI corresponding to the content of explanatory file 211 is providedto the user.
  • explanatory page 212 shown, for example, in Fig. 12 is displayed.
  • response message tm17 containing ADF 213 corresponding to the content of request message tm 16 is produced.
  • Response message tm 17 is transmitted from IP server unit 12, and is received by mobile unit 16.
  • mobile unit 16 on the basis of the content of ADF 213, whether the first non-trusted Java-AP software can be installed is determined. As mentioned above, since mobile unit 16 is in the status in which non-trusted Java-AP software can be installed, installation of the first non-trusted Java-AP software is determined to be possible in mobile unit 16.
  • ADF 213 is written into fixed memory 16D.
  • package URL http://www.ccc.co.jp/shogi.jar
  • request message tm 18 requesting transmission of Jar file 214 identified by the package URL is produced.
  • Request message tm 18 is transmitted by mobile unit 16, and is received by IP server unit 12.
  • response message tm 19 containing Jar file 214 is produced in response to the content of request message tm 18.
  • Response message tm 19 is transmitted by IP server unit 12, and is received by mobile unit 16.
  • Jar file 214 is written into fixed memory 16D in the status in which activation is possible, and installation of the first non-trusted Java-AP software is completed.
  • the status of mobile unit 16 returns to the status that existed before the acquisition of ADF 213 began.
  • the installation operation of the second non-trusted Java-AP software begins when the user tries to obtain explanatory file 207 or list file 200 by operating mobile unit 16.
  • the operation, which begins by trying to obtain explanatory file 207 is a subset of the operation, which begins by trying to obtain list file 200; therefore, only the operation,which begins by trying to obtain list file 200 is explained hereinafter.
  • request message tm 20 containing URL of list file 200 ("http://www.aaa.cojp/def.html") as a parameter of the GET method is produced.
  • Request message tm 20 is transmitted by mobile unit 16, and is received by administering server unit 18.
  • response message tm 21 containing list file 200 is produced in response to the content of request message tm 20.
  • Response message tm 21 is transmittedby administering server unit 18, and is received by mobile unit 16.
  • list file 200 in response message tm 21 is interpreted in accordance with HTML, and UI corresponding to the content of list file 200 is provided to the user of mobile unit 16.
  • list page 201 shown, for example, in Fig. 10 is displayed.
  • request message tm 22 containing URL ("http://www.ccc.co.jp.jkl.html") corresponding to option 201B as a parameter of the GET method is produced.
  • Request message tm 22 is transmitted by mobile unit 16, and is received by IP server unit 12.
  • response message tm 23 containing explanatory file 207 is produced in response to the content of request message tm 22.
  • Response message tm 23 is transmittedby IP server unit 12, and is received by mobile unit 16.
  • mobile unit 16 UI corresponding to the content of explanatory file 207 is providedto the user.
  • explanatory page 208 shown, for example, in Fig. 14 is displayed.
  • response message tm 27 containing ADF 209 corresponding to the content of request message tm 26 is produced.
  • Response message tm 27 is transmitted by IP server unit 12, and is received by mobile unit 16.
  • mobile unit 16 on the basis of the content of ADF 209, whether the second non-trusted Java-AP software can be installed is determined. As mentioned above, since mobile unit 16 is in the status in which the second non-trusted Java-AP software can be installed, the second non-trusted Java-AP software is determined as installable in mobile unit 16.
  • ADF 209 is written into fixed memory 16D.
  • package URL http://www.ccc.co.jp/horoscope.jar
  • request message tm 28 requesting transmission of jar file 210 identified by package URL is produced.
  • Request message tm 28 is transmitted by mobile unit 16, and is received by IP server unit 12.
  • response message tm 29 containing Jar file 210 in response to the content of request message tm 28 is produced.
  • Response message tm 29 is transmittedby IP server unit 12, and is received by mobile unit 16.
  • mobile unit 16 Jar file 210 is written into fixed memory 16D, and installation of the second Java-AP software is completed.
  • the installation operation of the trusted Java-AP software begins when the user tries to obtain explanatory file 202 or list file 200 by operating mobile unit 16.
  • the operation, which begins by trying to obtain explanatory file 202 is a subset of the operation,which begins by trying to obtain list file 200; therefore, the operation, which begins by trying to obtain explanatory file 202 is omitted.
  • Fig. 19 in the operation which begins by trying to obtain list file 200, an operation identical to the operation shown in Fig. 18 is carried out till list page 201 shown, for example, in Fig. 10 is displayed after mobile unit 16 receives response message tm 21.
  • request message tm 32 containing URL corresponding to option 201A ("http://www.main.bbb.co.jp/ghi.html") as a parameter of the GET method is produced in mobile unit 16.
  • Request message tm 32 is transmitted by mobile unit 16, and is received by IP server unit 13.
  • response message tm 33 containing explanatory file 202 in response to the content of request message tm 32 is produced.
  • Response message tm 33 is transmitted by IP server unit 13, and is received by mobile unit 16.
  • mobile unit 16 the user is provided with UI corresponding to the content of explanatory file 202.
  • explanatory page 203 shown, for example, inFig. 16 is displayed.
  • ADF 205 is written into fixed memory 16D, and whether trusted Java-AP software is installable is determined on the basis of the content of ADF 205. As mentioned above, since mobile unit 16 is in the status in which trusted Java-AP software is installable, trusted Java-AP software is determined to be installable in mobile unit 16.
  • request message tm 36 requesting transmission of SDF 204 identified by SDF-URAL "http://www.aaa.co.jp/viewer.sdf" contained in ADF 205 is produced.
  • Request message tm 36 is transmitted from mobile unit 16, and is received by administering server unit 18.
  • response message tm 37 containing SDF 204 corresponding to the content of request message tm 36 is produced.
  • Response message tm 37 is transmitted from administering server unit 18, and is received by mobile unit 16 via gateway server unit 17 and mobile packet communication network 15.
  • the communication path between administering server unit 18 and gateway server unit 17 is an exclusive line, and SDF 204 cannot be falsified until SDF 204 is received by mobile unit 16 since gateway server unit 17 is directly connected to mobile packet communication network 15 whose security is assured.
  • the authenticity of SDF 204 is determined by using the public key contained in ADF 205.
  • the public key contained in ADF 205 corresponds to the secret key used for signing SDF 204; therefore, SDF 204 is determined to be authentic as long as the content of SDF 204 is not changed in administering server unit 18.
  • APID contained in ADF 205 and APID contained in SDF 205 are compared. As mentioned above, since APID, which correspondsto APID in SDF 204 is specified to be written in ADF 205 in IP server unit 13, APID contained in ADF 205 and APID contained in SDF 204 match as long as no mistakes exist in description and so forth. Then, in mobile unit 16, SDF 204 is written into fixed memory 16D.
  • package URL http://www.main.bbb.co.jp/viewer.jar
  • request message tm 38 requesting transmission Jar file 206 identified by the package URL is produced.
  • Request message tm 38 is transmitted from mobile unit 16, and is received by IP server unit 13.
  • response message tm 39 containing Jar file 206 corresponding to the content of request message tm 38 is produced.
  • Response message tm 39 is transmitted from IP server unit 13, and is received by mobile unit 16.
  • the hash value is calculated by using the hash function of Jar file 206 and the specified hash function, and the calculated hash value and the hash value contained in ADF 205 are compared.
  • the hash values match as long as no mistakes exist in description and so forth.
  • Jar file 206 is written into fixed memory 16D in the status in which activation is possible, and installation of trusted Java-AP software is completed.
  • SDF 204 When SDF 204 is determined to be not authentic in mobile unit 16; APID contained in ADF 205 and APID contained in SDF 204 do not match; trusted Java-AP software is determined to be not installable; or the hash value calculated and the hash value contained in ADF 205 do not match, the status of mobile unit 16 returns to that existing before the acquisition of SDF 205 begins.
  • non-trusted Java-AP software including both the first non-trusted Java-AP software (tsume-shogi) and the second non-trusted Java-AP software (horoscope)
  • JAM the functions corresponding to the software
  • non-trusted Java-AP When API, which non-trusted Java-AP is about to use is non-trusted API, the use of API in this case is approved by JAM since non-trusted API is allowed to use any Java-AP as mentioned above. Hence, non-trusted Java-AP can use non-trusted API.
  • JAM checks whether SDF corresponding to the Java-AP is stored in fixed memory 16D. At this stage, since such SDF is not stored in fixed memory 16D, JAM forbids the use of the API by the non-trusted Java-AP. Hence, non-trusted first Java-AP will not be able to use trusted API.
  • mobile unit 16 when the installed trusted Java-AP software (telephone directory viewer) is activated in mobile unit 16 in which JAM is achieved, and the functions corresponding to the software are achieved in mobile unit 16, will be explained.
  • trusted Java-AP software telephone directory viewer
  • Mobile unit 16 constantly monitors the present date and hour clocked by timer unit 16H and a plurality of expiration dates contained in each SDF obtained so far, and determines whether the expiration date is reached. At this stage, when the present date and hour clocked by timer unit 16H becomes 10:00 AM of October 1, 2002, the expiration date of trusted Java-AP software (telephone directory viewer) corresponding to APID "0001" is reached, and the operation shown in Fig.20 begins as a result.
  • trusted Java-AP software telephone directory viewer
  • mobile unit 16 displays a message on displaying unit 16c to ask the user whether to renew the expiration date since expiration date is reached along with the name of trusted Java-AP software "telephone directory viewer" whose expiration date is reached, and waits until the user operates.
  • mobile unit 16 interprets the content of the command, and produces request message tm 41 as a parameter of GET Method containing SDF-URL (http://www.aaa.co.jp/viewer.sdf) contained in ADF which contains APID "0001."
  • Request message tm 41 is transmitted from mobile unit 16,and is received by administering server unit 18.
  • response message tm 42 containing SDF 204a corresponding to the content of request message tm 41 is produced.
  • Response message tm 42 is transmitted from administering server unit 18, and is received by mobile unit 16.
  • mobile unit 16 determines whether SDF 204a is obtained by using the above-mentioned SDF-URL. At this stage, the process proceeds to the next stage since the success in obtaining SDF 204a is assumed. Then mobile unit 16 inspects (decrypts) the signature of SDF 204a by using the public key contained in ADF 205, which has already been obtained, and determines the authenticity of SDF 204a. When the authenticity is confirmed (Step S 35; Yes), mobile unit 16 compares APID extracted from SDF 204a with APID contained in ADF 205, which has already been obtained, and determines whether the APIDs match.
  • mobile unit 16 writes SDF 204a over SDF 203 stored in fixed memory 16D, and the expiration date of trusted Java-AP software (telephone directory viewer) "10:00 AM October 1, 2002" is replaced by"10:00 AM January 1, 2003" in this manner.
  • trusted Java-AP software telephone directory viewer
  • JAM notifies to the user that the expiration date is not renewed, and returns the status of mobile unit 16 to that which existed before SDF 203a is obtained.
  • the present change includes the change of the content of Jar file 206 for the purpose such as the improvement of trusted Java-AP software, and the change of the transmission mode for the purpose such as alleviating the burden on IP server unit 13.
  • IP which administers IP server unit 13 and IP server unit 14, as shown in Fig. 22 stores Jar file 206 after the change (hereinafter, referred to as Jar file 215) in fixed memory 14A of IP server unit 14, and produces ADF 216 by changing the content of ADF 205 in accordance with Jar file 215.
  • Jar file 215 stores Jar file 206 after the change
  • ADF 216 by changing the content of ADF 205 in accordance with Jar file 215.
  • the above-mentioned operation is required for transmission of trusted Java-AP software after the change, and no operation is required for the communication provider, which administers administering server unit 18. In other words, the communication provider does not need to change list file 200 or SDF 204.
  • Fig. 23 The installation operation of trusted Java-AP software after such changes is shown in Fig. 23 .
  • the operation shown in Fig. 23 begins to differ from the operation shown in Fig. 19 when mobile unit 16 requests the Jar file.
  • response message tm 47 corresponds to response message tm 37
  • response message tm 48 corresponds to response message tm 38
  • response message tm 49 corresponds to response message tm 39.
  • Fib.23 differs from that of Fig.19 only in that ADF 216 and Jar file 215 are the objects of the process; request message tm 48 requesting transmission of Jar file 215 identified by package URL contained in ADF 216 ("http://www.sub.bbb.co.jp/viewer.jar") is produced in mobile unit 16; request message tm 48 is transmitted by mobile unit 16, and received by IP server unit 14; response message tm 49 containing Jar file 215 is produced in IP server unit 14; and response message tm 49 is transmitted by IP server unit 14, and is received by mobile unit 16.
  • request message tm 48 requesting transmission of Jar file 215 identified by package URL contained in ADF 216 ("http://www.sub.bbb.co.jp/viewer.jar" is produced in mobile unit 16; request message tm 48 is transmitted by mobile unit 16, and received by IP server unit 14; response message tm 49 containing Jar file 215 is produced in IP server unit 14; and response message tm 49 is transmitted by IP server unit 14, and
  • the operation in accordance with the content of policy information contained in the downloaded SDF is approved by trusted Java-AP software corresponding to SDF, and the operation, which is not contained in the content of policy information, is not approved. Since policy information is transmitted from administering server unit 18 to mobile unit 16 with the security assured, policy information cannot be falsified by a third person, and the trustworthness of trusted Java-AP is assured in this manner. Also, from the user's perspective, the convenience of the operation improves significantly since the above-mentioned trusted Java-AP with a greater freedom of operation approved becomes available, in addition to conventional non-trusted Java-AP.
  • each file is transmitted to mobile unit 16 in the order of ADF, SDF, and the Jar file. Transmitting the files in this order produces the effects explained below.
  • Java-AP software (ADF and the Jar file) is designed and produced by IP, and becomes available to general users at exclusive sites each IP opens on the Internet (IP server units 12-14 in Fig.1 ).
  • IP server units 12-14 in Fig.1 IP server units 12-14 in Fig.1 .
  • the user first accesses the exclusive site of IP, and usually determines whether to download the software by referring to explanatory pages of several Java-AP software. Then, when the user determines to download Java-AP software, the user needs to carry out the operation to command the downloading process.
  • URL of the file, which should be downloaded next is usually contained in the above-mentioned explanatory page for the purpose of downloading by anchor tag.
  • the above-mentioned order is advantageous when the process for version upgrade of Java-AP software, which is carried out in i-mode (trademark registered) of NTT DoCoMo is taken into account.
  • i-mode trademark registered
  • the mobile unit when a user carries out the operation to request version upgrade, the mobile unit first refers to the content written in ADF, and obtains the Jar file after version upgrade on the basis of package URL written in ADF.
  • ADF is first referred to, and the process of downloading is carried out thereafter.
  • the mobile unit confirms the authenticity of correspondence between the producer of SDF and that of ADF by using signature data by the secret key and the public key.
  • transmission need not be limited to the above-mentioned transmission method as long as the method used can confirm the authenticity of correspondence between the producer of SDF and that of ADF.
  • the number of processes in the mobile unit and the IP server unit, or the amount of communication among the mobile unit, the administering server unit and the IP server unit can be alleviated by the mode which does not contain the public key in SDF; does not sign ADF by using the secret key in the IP server unit; and omits the confirmation process of the signature in the mobile unit.
  • the hash value of the Jar file is included in ADF corresponding to the Jar file; and the hash value of the Jar file is produced in the mobile unit; then the authenticity of the correspondence of the Jar file and ADF is confirmed by comparing the hash value in ADF to the produced hash value.
  • any method can be used without limiting to the above-mentioned method as long as the method can confirm the authenticity of correspondence between the Jar file and ADF.
  • the number of processes in the mobile unit and the IP server unit, and the amount of communication between the mobile unit and the IP server unit can be alleviated by omitting the confirmation process of including the hash value in ADF.
  • the server is specified by using the domain name, but the server canalso be specified by using the IP address.
  • SDF can be determined to be authentic only when the domain name isthat of a server unit administered by a trustworthy organization.
  • mobile unit 16 displays a message that acquisition of SDF has failed, and finishes the process without requesting administering server unit 18 for SDF.
  • the letter string to be compared (for example, the letter string showing the domain name of the communication provider) is pre-stored in ROM or the fixed memory of the mobile unit.
  • ROM the letter string showing the domain name of the communication provider
  • higher security can be assured since the letter string cannot be rewritten.
  • trustworthy organizations can be stored after the purchase of the mobile unit; therefore, excellent convenience can be providedto a user and a trustworthy organization.
  • a high level of security is assured with a communication provide, which provides the communication path used for transmission of SDF as a trustworthy organization, but the technological scope of the present invention includes the mode in which the communication path is not provided by a trustworthy organization. For example, by connecting a trustworthy organization to a mobile unit by using an encrypted communication path, the trustworthy organization can transmit SDF via the encrypted communication path. Also, even if the security of the communication path is not assured, by transmitting after encrypting SDF, and decoding SDF in the mobile unit, SDF can be transmitted with a certain degree of security.
  • a trustworthy organization can be an IP, in other words, the administering unit could comprise an IP server unit.
  • API is the object for restricting the use by Java-AP, but the present invention is not limited to the above-mentioned description, and any resource can be the object.
  • the resource can be a hardware resource.
  • the resource can be a network resource, or a software resource (explained later).
  • a hardware resource can be a resource such as a memory, a speaker, a microphone, an infrared controller, LED (Light Emitting Diode) which a mobile unit can be equipped with, or an external hardware box such as UIM (User Identity Module) or SIM (Subscriber Identity Module) which functions with the mobile unit.
  • UIM User Identity Module
  • SIM Subscriber Identity Module
  • the mobile unit performs radio communication with the mobile communication network.
  • the mobile unit uses a radio resource such as a radio channel provided by the mobile communication network.
  • the radio resource is one of network resources.
  • the mobile unit in a higher communication protocol layer than the communication protocol layer the radio resource belongs to, uses a communication resource such as a transmission path of packets or a communication path of the connecting network.
  • the communication resources such as these are included as a network resource.
  • a software resource can be API, a class, a package and so forth.
  • Various functions are provided by a software resource, but a typical function can be a computation process such as encryption computation, or a function of transmitting or receiving data with other applications such as a Web browser.
  • the technological scope of the present invention includes the mode of restricting the use of a software resource, which the above mentioned external hardware box is equipped with.
  • the use of a hardware resource or a network resource by Java-AP generally takes place by using a software resource.
  • a mobile unit of the above-mentioned transmission system is also equipped with a software resource to use a hardware resource or a network resource, and by restricting the use of a software resource of this type the use of a hardware resource or a network resource is indirectly restricted.
  • a flag (permit/forbid) corresponding to one resource can be used, or permissions of a plurality of resources can be denoted by one piece of information.
  • the types of permission can be denoted to permit (or forbid) the use of a resource with a plurality of types.
  • the mobile unit a more precise control can be achieved.
  • the memory can be used for both reading out and writing in by trusted Java-AP although the memory is used only for reading out by non-trusted Java-AP.
  • control can be such that Java-AP which is permitted to "exclusively use a packet transmission path" can exclusively use a packet transmission path although the Java-AP which is not permitted to "exclusively use a packet transmission path" cannot exclude the sharing of packet transmission path by a Web browser and so forth.
  • Java-AP with a certain type of permission can exclusively use the packet communication path without the user's consent.
  • Java-AP with another permission can use the packet communication path without the user's consent, but needs to obtain the user's consent to exclusively use the packet communication path.
  • Java-AP with another permission can use the packet communication path without the user's consent, but cannot exclusively use the packet communication path.
  • Java-AP with another permission can use the packet communication path only with the user's permission.
  • Java-AP with another permission cannot even use the packet communication path.
  • "types of use" of the present invention also contain types of a process when a resource is used (a process of obtaining the user's consent/ a process of not obtaining the user's consent)
  • an identical list page is provided for all mobile units, but a different list page can be provided for each mobile unit.
  • the operation of Java-AP is restricted when the Java-AP is executed.
  • policy information in the Jar file stored in the IP server unit, and when the Jar file is downloaded in the mobile unit, activation of the Java-AP corresponding to the Jar file, or installation of Java-AP software containing the Jar file can be forbidden if comparison between the policy information and the policy information in SDF results in a mismatch. Only the permission given to the item as a result of the match in policy information can be valid.
  • the public key of the communication provider is provided to mobile unit 16 from IP server units 12-14 by being contained in ADF.
  • the public key can be pre-stored in the mobile unit.
  • methods of pre-storing the public key in the mobile unit methods such as transmitting through communication and by pre-storing in the fixed memory, or selling the mobile unit after writing the public key into ROM, are possible.
  • the expiration date can be set in accordance with the date as already explained, and for example, by the period after trusted Java-AP software is downloaded (for example; when trusted Java-AP is available only for a month after its installation), or the expiration date can be set by the number of times of execution, or the period of execution of trusted Java-AP software.
  • the expiration date can be any information as long as the upper threshold is set so as not to allow Java-AP software to be limitlessly executed.
  • the necessary information can be drawn from JAM, which refers to policy information in SDF each time trusted Java-AP software is activated, and the same number of references carried out by JAM can be counted as the number of times execution of trusted Java-AP software is carried out.
  • JAM refers to policy information in SDF each time trusted Java-AP software is activated
  • the means of accumulating and counting the period when trusted Java-AP software is executed for example, the means such as writing in the trusted Java-AP software as a subroutine
  • counting is possible even when the expiration date is set by the period of execution. Then, when the period of execution counted reaches the pre-determined time, the renewal process can be initiated.
  • the expiration date of trusted Java-AP software is used, but more precisely, the expiration date can be that of the Jar file itself, or even that of both.
  • trusted Java-AP software whose expiration date is reached is forbidden when the expiration date is reached but cannot be renewed
  • trusted Java-AP software can be changed to non-trusted Java-AP software when its expiration date is reached, instead of limiting in the manner as described above.
  • Java-AP software whose expiration date is reached is regarded as non-trusted Java-AP software, and is subject to greater restriction as non-trusted Java-AP software after the change.
  • the administering server unit is equipped with the memory unit to store SDF of several kinds of Java-AP software as in the above-mentioned embodiment.
  • the controller of the administering server unit receives each SDF from the communication unit, or when the controller receives SDF stored in the memory medium, the controller stores SDF in the memory unit.
  • the command to void the SDF for any trusted Java-AP software can be inputted.
  • the command contains APID of the trusted Java-AP software to which SDF to be voided corresponds.
  • the command as such is inputted to the inputting unit of the administering server unit by the operator; or the command is transmitted to the administering server unit from the relevant IP server unit via the network, and is received by the reception unit of the administering server unit.
  • the controller of the administering server unit receives the command via the inputting unit or the communication unit, the controller stores information showing that SDF identified by APID in the command is voided in the memory unit.
  • the terminal unit inquires the administering server unit about the validity of SDF in a constant period of time, and when the response showing that SDF is voided returns from the administering server unit, the terminal unit forbids the use of SDF thereafter. At this stage, shortening of the time period for inquiry is effective in decreasing the number of times execution of trusted Java-AP software is carried out after SDF is voided.
  • the administering server unit includes frequency data N and period data T when administering server unit transmits SDF from the communication unit to a terminal unit.
  • frequency data N is the data to command transmission of inquiry about the validity of SDF whenever the number of times execution of trusted Java-AP software is carried out exceeds the integral multiple of N.
  • period data T is the data to command transmission of inquiry about the validity of SDF when time T passes after the execution of trusted Java-AP software, and before the execution of Java-AP software is next initiated.
  • the terminal unit When the terminal unit receives certain SDF, the terminal unit transmits to the administering server unit the inquiry about the validity of SDF in accordance with frequency data N and period data T in SDF.
  • the configuration of the controller for carrying out the process for certain SDF is shown in Fig. 24 .
  • controllers shown in Fig. 24 are equipped for the same number of SDFs.
  • the elements denoted by codes 501-504 in Fig.24 show the circuit comprising the controller, or the routine executed by the controller.
  • the controller of the terminal unit receives SDF
  • the controller activates the circuit shown in Fig.24 or the routine for SDF.
  • the controller extracts frequency data N and period data T from SDF.
  • frequency data N is given to divider 502, and period data T is given to timer 503.
  • Counter 501 adds the counted number by one whenever trusted Java-AP software corresponding to SDF is activated.
  • Divider 502 divides the counted number from counter 501 (in other words,the number of times, activation of trusted Java-AP software is carried out) by frequent data N, and outputs signal "1" when the remainder as a result of the division becomes one.
  • Timer 503 specifically is a decrementing counter.
  • period data T is written into timer 503 as the initial value of the counted value.
  • timer 503 proceeds with decrementing count by being synchronized with the clock of the specific frequency. Then, when the period of time T is counted down, timer 503 outputs signal "1."
  • period data T is set to timer 503, and the new decrementing count begins from that time on.
  • OR gate 504 when signal "1" is outputted from divider 502 or timer 503, generates a signal to command inquiry about the validity of SDF.
  • Fig. 25 is a time-chart showing the above-mentioned operation.
  • OR gate 504 generates a signal to command inquiry about the validity of SDF such as N + the first time, 2N + the first time with frequency data N given.
  • the controller when the signal is generated, transmits to the administering server unit inquiry about the validity of SDF by the communication unit.
  • the inquiry contains APID to identify SDF, which is the object.
  • the controller of the administering server unit receives the inquiryfrom the communication unit, checks whether SDF identified by APID being inquired is valid by referring to the memory unit, and returns the outcome to the terminal unit by the communication unit.
  • the controller of the terminal unit receives from communication unit, a response that inquired SDF has expired, the controller carries out the operation so as not to allow Java-AP software corresponding to SDF to be activated.
  • a signal to command inquiry about the validity of SDF is generated since the time elapsed has exceeded T after the second time of execution of trusted Java-AP software before the third time of execution. Even in this case, the same inquiry, the response from the administering server unit, and the operation of the terminal unit in accordance with the response as the above-mentioned ones is carried out.
  • the present modification is effective for both types of users since both methods are used parallel to each other.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Information Transfer Between Computers (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)

Claims (10)

  1. Ein Übertragungsverfahren für eine Endgeräteinheit (16) und ein Übertragungssystem mit einer Informationsbereitstellenden-Servereinheit (12), speichernd eine Entity-Datei, die Software enthält zum Erreichen einer Anwendung; einer Administrations-Servereinheit (18), die eine Sicherheits-Deskriptive-Datei (18A), enthaltend Autorisierungsinformation, speichert, die eine Autorisierung zeigt, die an eine Anwendung gegeben wird, die erreicht wird, wenn die Endgeräteinheit (16) die Software ausführt; und einer anderen Informations-Bereitstellenden-Servereinheit (13, 14), die eine Anwendungs-Deskriptive-Datei mit Inhalten speichert, abhängig von der Entity-Datei, in die ein Speicherort der Entity-Datei und ein Speicherort der Sicherheits-Deskriptiven-Datei (18A) geschrieben werden; das Übertragungsverfahren, umfassend:
    einen Prozess zum Übertragen der Anwendungs-Deskriptiven-Datei an die Endgeräteinheit (16), wenn ein Speicherort der Anwendungs-Deskriptiven-Datei mitgeteilt wird durch die Endgeräteinheit (16);
    einen Prozess für die Endgeräteinheit (16) zum Mitteilen an das Übertragungssystem eines Speicherortes der Sicherheits-Deskriptiven-Datei (18A), enthalten in der Anwendungs-Deskriptiven-Datei, übertragen von dem Übertragungssystem;
    einen Prozess für das Übertragungssystem zum Übertragen an die Endgeräteinheit (16) der Sicherheits-Deskriptiven-Datei (18A) mit der Sicherheit der Sicherheits-Deskriptiven-Datei (18A) sichergestellt basierend auf dem Speicherort der mitgeteilten Sicherheits-Deskriptiven-Datei;
    einen Prozess für die Endgeräteinheit (16) zum Mitteilen an das Übertragungssystem des Speicherortes einer Entity-Datei, enthalten in der Anwendungs-Deskriptiven-Datei, übertragen von dem Übertragungssystem; und
    einen Prozess für das Übertragungssystem zum Übertragen an die Endgeräteinheit (16) der Entity-Datei auf Grundlage des Speicherortes der mitgeteilten Entity-Datei.
  2. Eine Endgeräteinheit (16), umfassend:
    eine Kommunikationseinheit (16F) zum Ausführen einer Kommunikation mit einer Einheit in einem Netzwerk;
    eine Speichereinheit (16A, 16E); und
    einen Controller,
    wobei der Controller (16B) umfasst:
    (a) Mittel zum Übertragen durch die Kommunikationseinheit (16F) an ein Übertragungssystem in dem Netzwerk einer ersten Übertragungsaufforderung zum Empfangen einer Anwendungs-Deskriptiven-Datei von einem Informations-Bereitstellenden-Server in dem Übertragungssystem und Speichern der Anwendungs-Deskriptiven-Datei in der Speichereinheit (16A, 16E), wobei die erste Übertragungsaufforderung Information enthält hinsichtlich eines Speicherortes der Anwendungs-Deskriptiven-Datei, die Anwendungs-Deskriptive-Datei Information enthält hinsichtlich eines Speicherortes einer Entity-Datei, enthaltend Software zum Erreichen einer Anwendung, und Information hinsichtlich eines Speicherortes einer Sicherheits-Deskriptiven-Datei (18A), enthaltend Autorisierungsinformation, die eine Autorisierung zeigt, die einer Anwendung gegeben wird, was erreicht wird durch Ausführen der Software;
    b) Mittel zum Übertragen durch die Kommunikationseinheit (16F) an das Übertragungssystem einer zweiten Übertragungsaufforderung zum Empfangen einer Sicherheits-Deskriptiven-Datei, wobei die zweite Übertragungsaufforderung Information enthält hinsichtlich eines Speicherortes der Sicherheits-Deskriptiven-Datei, enthalten in einer Anwendungs-Deskriptiven-Datei, empfangen von dem Übertragungssystem;
    c) Mittel zum Übertragen durch die Kommunikationseinheit (16F) an das Übertragungssystem einer dritten Übertragungsaufforderung zum Empfangen einer Entity-Datei von einem Informations-Bereitstellenden-Server in dem Übertragungssystem, wobei die dritte Übertragungsaufforderung Information enthält hinsichtlich eines Speicherortes der Entity-Datei, enthalten in der Anwendungs-Deskriptiven-Datei, empfangen von dem Übertragungssystem; und
    d) Mittel zum Beschränken, wenn eine Ausführung von Software, enthalten in einer Entity-Datei, gespeichert in der Speichereinheit, befohlen wird, eines Betriebs einer Anwendung, erreicht durch Ausführung der Software, gemäß einer Autorisierungsinformation, enthalten in einer Sicherheits-Deskriptiven-Datei (18A) entsprechend der Entity-Datei.
  3. Eine Endgeräteinheit (16) eines Anspruchs 2,
    wobei das Übertragungssystem eine Sicherheit sicherstellt durch Übertragen an die Endgeräteinheit (16) der Sicherheits-Deskriptiven-Datei (18A) nach einem Verschlüsseln der Sicherheits-Deskriptiven-Datei, und
    wobei der Controller (16B) Mittel umfasst zum Entschlüsseln einer verschlüsselten Sicherheits-Deskriptiven-Datei (18A), übertragen durch das Übertragungssystem.
  4. Eine Endgeräteinheit (16) von Anspruch 2,
    wobei der Controller (16B) die Sicherheits-Deskriptive-Datei (18A) durch die Kommunikationseinheit (16F) empfängt über einen Kommunikationspfad, dessen Sicherheit sichergestellt ist.
  5. Eine Endgeräteinheit (16) von Anspruch 2,
    wobei die Anwendungs-Deskriptive-Datei einen öffentlichen Schlüssel eines Kommunikationsanbieters enthält, der einen Kommunikationsdienst der Endgeräteinheit (16) bereitstellt,
    wobei die Sicherheits-Deskriptive-Datei (18A) signiert ist durch einen geheimen Schlüssel des Kommunikationsanbieters, und
    wobei der Controller (16B) eine Authentizität einer Sicherheits-Deskriptive-Datei (18A) überprüft, die übertragen wird durch das Übertragungssystem unter Verwendung eines öffentlichen Schlüssels, enthalten in der Anwendungs-Deskriptiven-Datei, und einen Speicherort der Entity-Datei dem Übertragungssystem nur mitteilt, wenn die Authentizität bewiesen ist.
  6. Eine Endgeräteinheit (16) von Anspruch 2,
    wobei die Anwendungs-Deskriptive-Datei und die Sicherheits-Deskriptive-Datei (18A) einen Anwendungsidentifizierer enthalten, zugeordnet zu einer entsprechenden Anwendung, und
    wobei der Controller (16B) einen Anwendungsidentifizierer, enthalten in einer Anwendungs-Deskriptive-Datei, übertragen durch das Übertragungssystem, mit einem Anwendungsidentifizierer, enthalten in einer Sicherheits-Deskriptiven-Datei (18A), übertragen durch das Übertragungssystem, vergleicht, und einen Speicherort der Entity-Datei dem Übertragungssystem nur mitteilt, wenn beide Identifizierer übereinstimmen.
  7. Eine Endgeräteinheit (16) von Anspruch 2,
    wobei der Controller (16B) einen Speicherort der Sicherheits-Deskriptiven-Datei (18A) dem Übertragungssystem nur mitteilt, wenn ein Speicherort der Sicherheits-Deskriptiven-Datei (18A), eingeschrieben in der Anwendungs-Deskriptiven-Datei, innerhalb der Administrations-Servereinheit ist.
  8. Eine Endgeräteinheit (16) von Anspruch 2,
    wobei die Sicherheits-Deskriptive-Datei (18A) Zeitbegrenzungsinformation enthält, die Ablaufdatum einer entsprechenden Anwendung zeigt, und der Controller (16B) Mittel umfasst zum wiederholten Empfangen der Sicherheits-Deskriptiven-Datei (18A) in einer chronologischen Reihenfolge von dem Übertragungssystem durch wiederholtes Mitteilen eines Speicherortes der Sicherheits-Deskriptiven-Datei (18A) an das Übertragungssystem in einer chronologischen Reihenfolge; und Erneuern eines Ablaufdatums der Anwendung auf Grundlage der Zeitbegrenzungsinformation, enthalten in der Sicherheits-Deskriptiven-Datei (18A), die wiederholt empfangen wird.
  9. Eine Endgeräteinheit (16) von Anspruch 8,
    wobei die Endgeräteinheit (16) ein Ablaufdatum der Anwendung nur erneuert, wenn die Sicherheits-Deskriptive-Datei (18A) richtig übertragen wird von dem Übertragungssystem.
  10. Ein Übertragungssystem, umfassend:
    eine oder eine Vielzahl von Servereinheiten (12, 13, 14), wobei eine Entity-Datei, eine Sicherheits-Deskriptive-Datei (18A) und eine Anwendungs-Deskriptive-Datei gespeichert werden, wobei die Entity-Datei Software enthält zum Erreichen einer Anwendung, die Sicherheits-Deskriptive-Datei (18A) Autorisierungsinformation enthält, die eine Autorisierung zeigt, die an eine Anwendung gegeben wird, die erreicht wird, durch Ausführen der Software, und eine Anwendungs-Deskriptive-Datei Inhalte aufweist, abhängig von der Entity-Datei, in die Speicherorte der Entity-Datei und der Sicherheits-Deskriptiven-Datei (18A) geschrieben werden,
    wobei eine Servereinheit (12) unter der einen oder Vielzahl von Servereinheiten (12, 13, 14), in die die Sicherheits-Deskriptive-Datei (18A) gespeichert wird, eine Administrations-Servereinheit (18) ist, an die eine Autorisierung zum Verwalten einer Sicherheits-Deskriptiven-Datei (18A) gegeben wird,
    wobei jede der Servereinheiten (12, 13, 14) Mittel umfasst zum Zurückgeben an einen Ursprung einer Mitteilung mindestens eines der Gruppe einer Entity-Datei und einer Anwendungs-Deskriptiven-Datei, wenn ein Speicherort der Datei mitgeteilt wird, und
    wobei die Administrations-Servereinheit (18), wenn ein Speicherort der Sicherheits-Deskriptiven-Datei (18A) mitgeteilt wird, die Sicherheits-Deskriptive-Datei (18A) an einen Ursprung der Mitteilung mit der Sicherheit der Sicherheits-Deskriptiven-Datei (18A) sichergestellt, zurückgibt.
EP03715596.7A 2002-04-03 2003-03-28 Verteilungsverfahren, Verteilungssystem und Endgeräteeinrichtung Expired - Lifetime EP1491996B1 (de)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
JP2002101756 2002-04-03
JP2002101756 2002-04-03
PCT/JP2003/003974 WO2003083646A1 (fr) 2002-04-03 2003-03-28 Procede et systeme de distribution, et terminal

Publications (3)

Publication Number Publication Date
EP1491996A1 EP1491996A1 (de) 2004-12-29
EP1491996A4 EP1491996A4 (de) 2008-12-10
EP1491996B1 true EP1491996B1 (de) 2014-02-12

Family

ID=28672125

Family Applications (1)

Application Number Title Priority Date Filing Date
EP03715596.7A Expired - Lifetime EP1491996B1 (de) 2002-04-03 2003-03-28 Verteilungsverfahren, Verteilungssystem und Endgeräteeinrichtung

Country Status (8)

Country Link
US (1) US7587592B2 (de)
EP (1) EP1491996B1 (de)
JP (1) JP4078313B2 (de)
CN (2) CN1992724B (de)
AU (1) AU2003220927A1 (de)
ES (1) ES2461241T3 (de)
TW (1) TWI229531B (de)
WO (1) WO2003083646A1 (de)

Families Citing this family (39)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2003202929A (ja) * 2002-01-08 2003-07-18 Ntt Docomo Inc 配信方法および配信システム
JP4176533B2 (ja) * 2003-03-31 2008-11-05 株式会社エヌ・ティ・ティ・ドコモ 端末装置及びプログラム
US8302111B2 (en) 2003-11-24 2012-10-30 Time Warner Cable Inc. Methods and apparatus for hardware registration in a network device
US7266726B1 (en) 2003-11-24 2007-09-04 Time Warner Cable Inc. Methods and apparatus for event logging in an information network
JP4164036B2 (ja) * 2004-02-05 2008-10-08 トレンドマイクロ株式会社 ネットワークを介して提供されるプログラムに対する受信装置上でのセキュリティの確保
US9213538B1 (en) 2004-02-06 2015-12-15 Time Warner Cable Enterprises Llc Methods and apparatus for display element management in an information network
US8078669B2 (en) 2004-02-18 2011-12-13 Time Warner Cable Inc. Media extension apparatus and methods for use in an information network
JP4994575B2 (ja) * 2004-03-12 2012-08-08 キヤノン株式会社 ネットワークインターフェース装置及びその制御方法、及び画像形成システム
CN100580611C (zh) * 2004-06-30 2010-01-13 松下电器产业株式会社 程序执行设备及该程序执行方法
AU2004322201B2 (en) * 2004-08-12 2008-10-30 Fujitsu Limited Java applet, jar file creating method, jar file creating program, and jar file creating device
US20060107327A1 (en) * 2004-11-16 2006-05-18 Sprigg Stephen A Methods and apparatus for enforcing application level restrictions on local and remote content
US8429755B2 (en) 2005-05-26 2013-04-23 Sandisk Technologies Inc. System and method for receiving digital content
KR20070079257A (ko) * 2006-02-01 2007-08-06 엘지전자 주식회사 데이터 방송 관련 어플리케이션의 제한 방법, 클래스와인터페이스 구조 및 이를 위한 방송 수신기
CN100428731C (zh) * 2006-06-02 2008-10-22 清华大学 基于智能交换机的星形网络防入侵和攻击的方法
US20080027945A1 (en) * 2006-07-28 2008-01-31 Nichols Paul H Methods, systems and computer program products for downloading a Java application based on identification of supported classes
JP2008065693A (ja) * 2006-09-08 2008-03-21 Ricoh Co Ltd 情報処理装置、そのインストール制御方法及びインストール制御プログラム
US8370818B2 (en) 2006-12-02 2013-02-05 Time Warner Cable Inc. Methods and apparatus for analyzing software interface usage
CN101196974B (zh) * 2006-12-06 2011-08-24 国际商业机器公司 用于软件应用程序的自动配置的方法和系统
US8649276B2 (en) * 2008-07-31 2014-02-11 Microsoft Corporation Content transfer
US8103718B2 (en) 2008-07-31 2012-01-24 Microsoft Corporation Content discovery and transfer between mobile communications nodes
KR101528856B1 (ko) * 2008-08-14 2015-06-15 삼성전자주식회사 애플리케이션 제어 정보를 획득하는 컨텐츠 수신 장치 및 그 방법
US9256488B2 (en) * 2010-10-05 2016-02-09 Red Hat Israel, Ltd. Verification of template integrity of monitoring templates used for customized monitoring of system activities
US9355004B2 (en) 2010-10-05 2016-05-31 Red Hat Israel, Ltd. Installing monitoring utilities using universal performance monitor
US9363107B2 (en) 2010-10-05 2016-06-07 Red Hat Israel, Ltd. Accessing and processing monitoring data resulting from customized monitoring of system activities
US9524224B2 (en) 2010-10-05 2016-12-20 Red Hat Israel, Ltd. Customized monitoring of system activities
CN102426639B (zh) * 2011-09-26 2015-04-08 宇龙计算机通信科技(深圳)有限公司 信息安全监测方法和装置
CN102752137B (zh) * 2012-06-28 2015-10-21 用友网络科技股份有限公司 主动设置虚拟机网络参数的装置和方法
US8949818B2 (en) 2012-06-29 2015-02-03 Intel Corporation Mechanism for facilitating dynamic and trusted cloud-based extension upgrades for computing systems
JP2014164392A (ja) * 2013-02-22 2014-09-08 Dainippon Printing Co Ltd 情報処理装置および情報処理システム
US9961056B2 (en) 2015-01-07 2018-05-01 Cyph, Inc. Method of deniable encrypted communications
US10419223B2 (en) * 2015-01-07 2019-09-17 Cyph, Inc. Method of using symmetric cryptography for both data encryption and sign-on authentication
WO2016114822A1 (en) 2015-01-16 2016-07-21 Cyph Inc. A system and method of cryprographically signing web applications
US11716558B2 (en) 2018-04-16 2023-08-01 Charter Communications Operating, Llc Apparatus and methods for integrated high-capacity data and wireless network services
WO2020054600A1 (ja) * 2018-09-11 2020-03-19 株式会社ブックウォーカー 電子コンテンツ閲覧システム、電子コンテンツ閲覧方法、及び、コンピュータ読出可能記録媒体
WO2020077346A1 (en) 2018-10-12 2020-04-16 Charter Communications Operating, Llc Apparatus and methods for cell identification in wireless networks
US11129171B2 (en) 2019-02-27 2021-09-21 Charter Communications Operating, Llc Methods and apparatus for wireless signal maximization and management in a quasi-licensed wireless system
US11026205B2 (en) 2019-10-23 2021-06-01 Charter Communications Operating, Llc Methods and apparatus for device registration in a quasi-licensed wireless system
DE102020116791A1 (de) * 2020-06-25 2021-12-30 Technische Universität Dresden Vorrichtung und Verfahren zum computergestützten Verarbeiten von Daten
CN117252188B (zh) * 2023-10-17 2024-03-26 广东深博信息科技有限公司 一种基于人工智能的软件映像监控方法及系统

Family Cites Families (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6345288B1 (en) * 1989-08-31 2002-02-05 Onename Corporation Computer-based communication system and method using metadata defining a control-structure
JPH07230380A (ja) * 1994-02-15 1995-08-29 Internatl Business Mach Corp <Ibm> 適用業務プログラムの利用管理方法およびシステム
US5708709A (en) * 1995-12-08 1998-01-13 Sun Microsystems, Inc. System and method for managing try-and-buy usage of application programs
US5825877A (en) * 1996-06-11 1998-10-20 International Business Machines Corporation Support for portable trusted software
TW313642B (en) 1996-06-11 1997-08-21 Ibm A uniform mechanism for using signed content
US6167520A (en) 1996-11-08 2000-12-26 Finjan Software, Inc. System and method for protecting a client during runtime from hostile downloadables
US6317742B1 (en) * 1997-01-09 2001-11-13 Sun Microsystems, Inc. Method and apparatus for controlling software access to system resources
JPH11205767A (ja) 1998-01-16 1999-07-30 Sony Corp 受信装置及びデータ書換え方法
AU1889699A (en) 1999-01-13 2000-08-01 Hitachi Limited Method and system for executing mobile code
FI990461A0 (fi) * 1999-03-03 1999-03-03 Nokia Mobile Phones Ltd Menetelmä ohjelmiston lataamiseksi palvelimelta päätelaitteeseen
US6976165B1 (en) * 1999-09-07 2005-12-13 Emc Corporation System and method for secure storage, transfer and retrieval of content addressable information
JP2001117769A (ja) 1999-10-20 2001-04-27 Matsushita Electric Ind Co Ltd プログラム実行装置
IL139327A (en) 1999-11-22 2005-06-19 Sun Microsystems Inc Mechanism for determining restrictions to impose on an implementation of a service
JP3740931B2 (ja) 2000-03-01 2006-02-01 日本電信電話株式会社 アプリケーションプログラム管理方法及びシステム及びコンピュータ読み取り可能な記録媒体
EP1132796A1 (de) 2000-03-08 2001-09-12 Universite Catholique De Louvain Mobiler Kode und Verfahren zur Betriebsmittelverwaltung für mobilen Kode
US6971016B1 (en) * 2000-05-31 2005-11-29 International Business Machines Corporation Authenticated access to storage area network
KR100671471B1 (ko) * 2000-07-08 2007-01-18 (주) 엘지텔레콤 이동통신단말기를 이용한 자바 프로그램 실행 방법 및이를 수행하기 위한 시스템
US6766353B1 (en) * 2000-07-11 2004-07-20 Motorola, Inc. Method for authenticating a JAVA archive (JAR) for portable devices
JP2002182983A (ja) * 2000-12-13 2002-06-28 Sharp Corp データベースへのアクセス制御方法、データベース装置、リソースへのアクセス制御方法、情報処理装置
JP2003050641A (ja) 2001-08-07 2003-02-21 Nec Corp プログラム管理システム、そのプログラム管理方法、及び情報管理プログラム
EP1289326A1 (de) 2001-08-30 2003-03-05 Motorola, Inc. Verfahren und Gerät zum Überprüfen von heruntergeladener Software
US7003672B2 (en) * 2001-09-25 2006-02-21 Hewlett-Packard Development Company, L.P. Authentication and verification for use of software
JP4145118B2 (ja) 2001-11-26 2008-09-03 松下電器産業株式会社 アプリケーション認証システム
JP2003202929A (ja) * 2002-01-08 2003-07-18 Ntt Docomo Inc 配信方法および配信システム
JP4176533B2 (ja) * 2003-03-31 2008-11-05 株式会社エヌ・ティ・ティ・ドコモ 端末装置及びプログラム

Also Published As

Publication number Publication date
CN1992724A (zh) 2007-07-04
WO2003083646A1 (fr) 2003-10-09
US20050160045A1 (en) 2005-07-21
CN1332301C (zh) 2007-08-15
CN1992724B (zh) 2012-05-09
JP4078313B2 (ja) 2008-04-23
TW200306108A (en) 2003-11-01
ES2461241T3 (es) 2014-05-19
US7587592B2 (en) 2009-09-08
CN1647029A (zh) 2005-07-27
EP1491996A4 (de) 2008-12-10
AU2003220927A1 (en) 2003-10-13
EP1491996A1 (de) 2004-12-29
JPWO2003083646A1 (ja) 2005-08-04
TWI229531B (en) 2005-03-11

Similar Documents

Publication Publication Date Title
EP1491996B1 (de) Verteilungsverfahren, Verteilungssystem und Endgeräteeinrichtung
EP1465039B1 (de) Inhaltsablieferungsverfahren und inhaltsablieferungssystem
EP1465041B1 (de) Kommunikationsvorrichtung, -methode, und -programm zur Überprüfung der Durchführungsrechte der Software
US8291482B2 (en) System for restricting content access and storage
KR100718068B1 (ko) 어플리케이션에 의한 기억영역의 사용 관리 방법
EP1454499A1 (de) Mobil-internet-lösung mit java-anwendung kombiniert mit lokaler drahtloser schnittstelle
US7558963B2 (en) Communication device and program
JP4336383B2 (ja) 端末装置およびプログラム
KR20060023630A (ko) 자원 공유 서비스 기능이 있는 이동통신 단말기, 그를이용한 자원 공유 시스템 및 자원 제공과 이용 방법
JP4358478B2 (ja) 通信端末のアクセス制御方法、コンテンツの提供方法、通信システムおよび中継装置
JP5132730B2 (ja) 配信方法および配信システム
JP2008123514A (ja) 配信方法および配信システム

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20040924

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LI LU MC NL PT RO SE SI SK TR

RIC1 Information provided on ipc code assigned before grant

Ipc: 7G 06F 13/00 B

Ipc: 7H 04M 11/00 B

Ipc: 7G 06F 1/00 B

Ipc: 7G 06F 9/06 A

Ipc: 7G 06F 17/30 B

Ipc: 7H 04L 29/06 B

A4 Supplementary search report drawn up and despatched

Effective date: 20081112

17Q First examination report despatched

Effective date: 20100111

GRAJ Information related to disapproval of communication of intention to grant by the applicant or resumption of examination proceedings by the epo deleted

Free format text: ORIGINAL CODE: EPIDOSDIGR1

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

INTG Intention to grant announced

Effective date: 20130905

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LI LU MC NL PT RO SE SI SK TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 652407

Country of ref document: AT

Kind code of ref document: T

Effective date: 20140215

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 60345689

Country of ref document: DE

Effective date: 20140327

REG Reference to a national code

Ref country code: NL

Ref legal event code: T3

REG Reference to a national code

Ref country code: ES

Ref legal event code: FG2A

Ref document number: 2461241

Country of ref document: ES

Kind code of ref document: T3

Effective date: 20140519

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 652407

Country of ref document: AT

Kind code of ref document: T

Effective date: 20140212

REG Reference to a national code

Ref country code: GR

Ref legal event code: EP

Ref document number: 20140400827

Country of ref document: GR

Effective date: 20140625

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140612

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 60345689

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

26N No opposition filed

Effective date: 20141113

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20140331

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20140328

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20140331

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 60345689

Country of ref document: DE

Effective date: 20141113

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 13

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: ES

Payment date: 20150312

Year of fee payment: 13

Ref country code: NL

Payment date: 20150323

Year of fee payment: 13

Ref country code: IT

Payment date: 20150323

Year of fee payment: 13

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GR

Payment date: 20150330

Year of fee payment: 13

Ref country code: GB

Payment date: 20150311

Year of fee payment: 13

Ref country code: FR

Payment date: 20150323

Year of fee payment: 13

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: BE

Payment date: 20150323

Year of fee payment: 13

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20030328

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20140328

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20140212

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20160331

REG Reference to a national code

Ref country code: NL

Ref legal event code: MM

Effective date: 20160401

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20160328

REG Reference to a national code

Ref country code: FR

Ref legal event code: ST

Effective date: 20161130

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20160331

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20160328

Ref country code: NL

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20160401

REG Reference to a national code

Ref country code: GR

Ref legal event code: ML

Ref document number: 20140400827

Country of ref document: GR

Effective date: 20161006

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20160328

Ref country code: GR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20161006

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20170321

Year of fee payment: 15

REG Reference to a national code

Ref country code: ES

Ref legal event code: FD2A

Effective date: 20170428

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20160329

REG Reference to a national code

Ref country code: DE

Ref legal event code: R119

Ref document number: 60345689

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20181002